World 8: Shields: Security

Signed commits

You will learn: how to prove a commit is really yours, with a Verified badge.

The problem

~/diary $ git config --global user.name "Siti"~/diary $ git commit -m "Add footer"[main effd720] Add footer 1 file changed, 1 insertion(+)~/diary $ git log -n 1commit effd72004cf17e28717fc94e6a7a5646622b1102 (HEAD -> main)Author: Siti <you@example.com>Date:   Fri Oct 30 09:04:00 2026 +0800    Add footer

Git trusts any name you type. Anyone can make commits that say “Siti”. So how can people trust a commit is really yours?

Watch

A carries your digital signature. Only your private key can make it. GitHub checks it with your public key, like a key in its lock.

Watch

Signature checks out? GitHub shows a badge next to the commit. Signed, but GitHub can’t check it? It says Unverified. Not signed? No badge at all.

Try it

Git can sign with an SSH key, like your key from World 4. Build the setting that picks SSH.

Tap the pieces in the right order.

…

Try it

Now set up signing here. You need three settings: the format, your key, and “sign every commit”.

Hint

Point user.signingkey at your public key, the file that ends in .pub.

Predict

You push a signed commit. But your public key is not on GitHub as a signing key. What does GitHub show?

Check

Which badge does each commit get? Sort them.

Drag a card into a box. Or tap the card, then tap the box.

You did it!

You can now sign your commits and read the Verified badge.

Go deeper (optional)

GPG keys work too. That’s the default format, openpgp. SSH signing needs Git 2.34 or newer. Turn on vigilant mode, and your unsigned commits show as Unverified. git log --show-signature shows signatures on your computer. For SSH, Git first needs gpg.ssh.allowedSignersFile.